EUVD-2018-4972

Malware in sbrugna...

CVE-2018-13023

System command injection vulnerability in wifiaccess in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter...

CVE-2018-16130

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

CVE-2018-16130

Affected product: Xiaomi Mi Router 3, firmware 2.22.15. Vulnerability: system command injection in the /request_mitv endpoint via the payload URL parameter, allowing an attacker to execute arbitrary commands. Root cause: unsanitized “payload” parameter leading to command execution. Impact: high (...

CVE-2018-13022

The Xiaomi Mi Router 3 (firmware version 2.22.15) is affected by a cross-site scripting (XSS) vulnerability in the API 404 page. The issue enables an attacker to inject and execute arbitrary JavaScript by supplying a crafted URL path. Public references across CNVD/CVE records confirm the same des...

CVE-2018-13023

A system command injection vulnerability exists in the wifi_access endpoint of the Xiaomi Mi Router 3 (version 2.22.15 ). The root cause is the improper neutralization of special elements used in an OS command, specifically via the "timeout" URL parameter. This flaw allows an attacker to execute ...

CVE-2018-13022

Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path...

Command injection

System command injection vulnerability in wifiaccess in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter...

Command injection

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

CVE-2018-13022

Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path...

CVE-2018-16130

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

CVE-2018-13023

System command injection vulnerability in wifiaccess in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter...

PT-2018-11542

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15 Description A cross-site scripting issue exists in the API 404 page, allowing attackers to execute arbitrary JavaScript code via a modified URL path. Recommendations For Xiaomi Mi Router 3 version 2.22.15,...

PT-2018-13414

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15 Description The issue allows attackers to execute arbitrary system commands via the payload variable in the request mitv function. This can be achieved by manipulating the "payload" URL parameter...

PT-2018-11543

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15 Description A system command injection issue exists, allowing attackers to execute system commands. This is achieved via the timeout URL parameter in the wifi access functionality. Recommendations For version...

CVE-2018-16130: Improper Neutralization of Special Elements used in an OS Command

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

CVE-2018-13023: Improper Neutralization of Special Elements used in an OS Command

System command injection vulnerability in wifiaccess in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter...

CVE-2018-13022: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path...